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Dr. John M. Deutch 

Under Secretary of Defense for Acquisitions 
3010 Defense Pentagon 
Room 3E933 Pentagon 
* Washington D.C. 20301-3010 

Dear Dr. Deutch, 



Attached are the Findings and Conclusions and the j 
Recommendations of the C-17 Executive Independent Review Team. 
Additionally, there are Appendices that provide definitions ahd 
background information. , I 



Sincerely yours. 
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0. The EIRT received excellent and exemplary support from both the SPO and 

McDonnell Douglas Aerospace engineers. Their competence, enthusiasm and 
dedication were very evident during our discussions. We greatly appreciate 
their patience in answering our qu^tions. In order to meet the very 
demanding U5AF requirements, Douglas has had to use the best of current 
engineering philosophy, processes and analytical methodologies. Compared 
to other transport category aircraft, the C-17 wing structure is effidendy 
designed and the EIRT believes Douglas engineering deserves praise for thei; 
accomplishment. 

1. The static test of the C-17 wing during the loading condition designated as SP 

5005^^ (maximum wing up-bending) was terminated by a failure located in 
bay 26 of the upper surface of the left hand wing at 144% of test limit load on 
Seprember 10, 1993. Damage to the left hand wing was extensive but most of 
this ^v'as secondary and can be attributed to the paroxysm of the loading jacks 
after the initial failure. 

2. Test SP5005M verified the strength of bay 26 to its specification level of 150% o: 

design limit load even though the test did not reacK its goal of 150% of test 
limit load. Due to the manner in which the test loads simulate the design 
limit loadsr 150% of design limit imposes the same stresses as does 144% of 
test limit in bay 26 because the test loads do not acomnt for the relieving 
effect of the chordwise bending caused by the winglet. 

3. The EIRT believes the entire upper surface of the wing has been qualified 
through a judicious combinadon of tests and analyses. 79% of the upper 
surface of the wing has been fully qualified by tests to 150% of test limit or 
design limit by SP5030M and SP5005M even d\ough SP5005M did not reach is 
objective of 150% of test limit load. Of the remaining 21% of the upper 
surface, some pordon is within one per cent of the stresses sufficient for 
qualification, another pordon is within two percent and the largest 
insufficiency is 4%. The engineering methodology to predict that a failure will 
not occur has been verified by the more than 600 separate beam-column 
structural components throughout the wing that did not fail under the 
loadings imposed by test SP^OM whidi attained 150% of test limit and by 
test SP5005M which attained 144%. Consequently, the EIRT believes it is 
appropriate to use analysis for the extrapoladon of the experimental data 
from 144% to 150%. Therefore analysis is the means whereby the remaining 
21% of the upper surface is qualiAed. Historically, this is the approach that has 
been used. 

4. The findings cited in (2) & (3) support the EIRT condxision that a rerun of 

condition 5P5005M to 150% will not yield signiHcant additional information 
on the strength of the wing. 



BRT 1 



FEB 09 '95 ll:27WI C17 CCDNTRPCTING DIV 



P. 4 



5. One of the abnormal conditions which increases the design bending moments 

on the wing is the so-called fuel imbalance that accounts for a potential 
system failure in the fuel system. This fuel imbalance is set at 8000 pounds for 
the C-17. (It was learned that the fuel unbalance for the MD-ll freighter is 
2500 pounds.) A reduction in the design bending moments accrues for the 
wing if the fuel imbalance can be reduced to 3000 pounds. Analyses and tests 
on other aircraft have demonstrated that this is readily achievable. The flight 
tests revealed an additional reduction in bending moment due to aileron 
effecti\ity and the fact that the flight control system is set so that the ailerons 
are not symmetrically deployed to counter the imbalance. Both of these 
changes In the spedficadons' would result in tests SP5030M and SP500SM 
having qualified 95% of the upper cover of the wing. 

6. The failure at 144% of lixrut condition SP 5005M was initiated by the crippling 

of the front spar cap inboard flange in bay 26 of the left hand wing. The eausa 
of the premature failure are as follows: 

a. The spar web in bay 26 had been iveakened by the prior tests of the 

wing. This weakened ^veb Induced additional loads that over- 
stressed the spar cap. Strain gage response reveals that prior tests 
had caused irreversible damage to the shear carrying capability of 
the web . 

b. The flange of the spar cap was undersized duet to a machining error. 

This means the strength of the flange, i.e., the crippUng allowable, 

is reduced below the value used in the design* 
The right hand wing did not exhibit any of these same symptoms- The EIRT 
concludes this failure is peculiar to bay 26 of the left hand wing of the static 
test artide; there are no implications for any other regions of the wing and 
hence modifications to the wing are not required. 

7. The EIRT endorses the so-called productionized wing and believes the use of 

larger aluminum extrusions is fundamentally superior to the use of steel 
doublers. The EIRT accepts the structural qualification by analysis of the 
larger extrusions. In this regard, the steel doubler reinforced members have 
been qualified by tests SP5030M and SPS005M. This gives assurance that 
analysis can be used because the structural parameters of the larger extrusions 
are %vlthin those of the steel reinforced z-strlngers. From a fatigue standpoint, 
the use of the extrusions is inherently better because the thousands of 
fasteners used in the steel doubler members have been eliminated. 
Additionally, the upper surface of the wing has ample margin to meet the 
durability requirements and the effect on the lower surface is beneficial but 
rather insignificant* 

8. The EIRT endorses, in principle, the steps being taken to modify the static test 

article so that the remaining static tests can be accomplished. In order to apply 
the loads to the right wing^ a large part of the left wing has been removed. 
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The remaining stub oi the left wing is being reinforced and modified to apply 
the loads necessary to balance the test loads on the right wing. 

9. There are a number of major tests to be accomplished before the airframe of 

the is fully qualified. The requirement is that all of these tests be carried 
to test ultimate. The portions of the airframe to be exercised in the remainir.f 
tests include downbending of the wing, bending of the fuselage, fuselage 
frames, the fuselage pressure shell and the pylons. It should be iK>ted u\at 
there are locations where the calculated margins of safety are below 5% and 
hence the possibility of a failure ia not remote. In this regard the EIRT is of ir.i 
opinion that three of these requirements are unrealistiodly too severe. The 
d>'T\amic taxi condition, T093W1, places all of the 159200 pounds of load as 
fuel in die wing with zero payload. This of course will maximize the stresses 
in the wing during high speed taxi. There is a itiselage jacking condition 
wherein there is maximum fuel in the wing while the airplane is completely 
supported on Jacks. This Is a back-breaker requirement for the fuselage. 
Finally the so-called 2P condition requires the testing of the fuselage to the 
maximum design pressure of 16.6 psl. Each airplane fuselage vfiM be tested, 
prior to delivery, to the proof pressure of 11 psl wWch is much larger than L-.i 
normal maximum cabin pressure of 7.8 psi. This proof pressure test fuUUls 
the spedftcation requirement for qualification of the fuselage structure. 

10. The planned sequence of the 017 wing static test program carried each 
condition to ultimate before proceeding to the next condition. In retrospect, :: 
was not the sequence to maximize the amount of data acquired with the 
minimum amount of disruption to the program. A better sequence would 
have been to carry each condition to limit and then to carry only one 
composite condition to ultimate. The design deficiency revealed by the test 
failure of October 1, 1992'would still have been found and neither the 
schedule disruption caused by the October 1, 1992 failure nor the test failure c: 
September 10, 1993 would have occurred had this latter sequence been in 
effect. It is even within reason to speculate that the strain gage data from all o: 
the tests to limit load may have revealed the design deficiency, permitting the 
design dianges to be incorporated prior, to the conduct of the ultimate test 
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1. The EIRT recommends that each of the remaining full scale static test 
conditions that involve the tsing and fuselage be carried just to test limit 
load before any condition is carried to test ultimate. The likelihood of an 
xmexpected failure inaeases as the load Increases above test limit As has been 
demonstrated, a failure can inflict serious damage to the wing and /or 
fuselage, causing at best, a major delay in the sdiedule or, at worst, the 
complete loss of the static test article. Such a sequence of completing firstly all 
of the conditions to test limit will insure that there will be, at the least data 
on the limit load response from all of the structure to be qualified by the 
remairUng tests. 

2. The EIRT, if asked, would approve a reduction in the number of tests 

remaining to be carried to test ultimate conditions. This test article has 
experienced the trauma of tivo failures, the wing has been loaded six times 
above limit conditions, seven other times to limit conditions and the left' 
wing now suffers the ignominy of being part of the*test fixtvire. Tlu EIRT 
recommends the C-27 Program Office determine which of the presently 
planned ultimate tests will revdtl understanding of the structural behavior 
not already confirmed hy tests to limit and prior tests to ultimate. In this 
regard, for example, the beam«eoIumn methodology has been validated by the 
previous upbending tests. The EIRT believes a reduction In the number of 
ultimate tests can be justified, and there will be concomitant cost and 
schedule beneHts. 

3. The EIRT believes that two of the remaining test conditions are unrealistically 

overly conservative. These are as follows: 

a. ThB dynamic taxi condition, T093W1, to meet the airplane gross 

u*eight of 434^500 pounds puts 159,200 pounds of fuel In the wing 
and no payload in the fuselage. This distribution of the 159,200 
pounds does maximize the downbending of the wing but it appears 
to the EIRT wholly unrepresentative of actual operations. 

b. The fuselage jacking condition, JK216M, has the wing completely 

fxiU of fuel with the airplane completely supported on jacks. This 
ground condition maxiixiizes the downbending of the fuselage 
appreciably beyond any flight condition. It does not seem 
reasonable to the EIRT to jack up the airplane with the wings full 
of fuel. For example, wheel dianges can be accomplished without 
this kind of jacking. 

Although the structure has been designed to meet these extreme dynamic taxi 
and jacking conditions, the EIRT recommends that the severity of these 
requirements be challenged on the bases of need and rationality. If relief will 
be granted, the EIRT recommends the test loadings be lowered accordingly. 
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4. The ultimate design pressure condition, 2p, requires the pressurization of the 

fuselage to 16 6 psi. Every production fuselage will be proof pressure tested in 
the factory to 11 psi which is larger than the normal operating pressure of 7.8 
psi. The EIRT believes the proof pressure test obviates the need for the 2p test 
It should be noted that a fuselage pressurized to 16.6 psi has sufficient stored 
energy to wrealt mtich damage to the stinroundings should a failure occur. 
Such a test to ultimate design pressure is not required of dvil transport 
category aircraft. The EIRT recommends that the 2p condition be eliminated 
from the full scale static test program. 

5. The EIRT recommends that steps he taken to reduce the allowable fuel 
unbalance from 8000 pounds to 3000 pounds. There are issues regarding the 
C-17 fuel measuring system that need to be resolved, but these appear to be 
surmountable. Reductions in loads should always be pursued espedally If, as 
is the case for the fuel imbalance, there are no operational impUcadons.- 

6. The EIRT recommends that the Program Office continue to challenge the Air 
Mobility Command on the magnitude of the payload asymmetry. The EIRT 
recognizes the load master loses some flexibility in -the placement of the 
payload if the payload asymmetry is reduced. A few tests have been conducted 
at Fort Hood that give promise of a reduction in the payload asymmetry that 
is acceptable to the load master. 

r 

7. The EIRT was surprised to learn that the C-17 does not have a load alleviation 

system. For example, such a system was incorporated into the C5-A. A load 
alle\iatlon system in ^e C17 would have apjnedably reduced structural 
weight Uiat could have been used to increase range and/or payload. Iliere is 
an understandable aversion to re-writing the flight control software necessary* 
to adiieve load alleviation. As already stated, r^tictions in loads should 
always be pursued, even for the C-17 airplane which is meeting all of its 
structural integrity requirements. A load alleviation system will make it 
easier to meet future changes in operational usage. The EIRT recommends 
that a load alleviation system be developed for the C-17* 

8. In retrospect the USAF requirement to test the C-17 static article to ultimate 

conditions several times was ill-devised. To meet the ultimate conditions, an 
efflcient structure will be operating in a regime where both material and 
geometric non-linearities are important. Tltis means the imposition of an 
ultimate condition will cause some permanent damage even if there has been 
no obvious failure. Thus, the next test condition is imposed not on the 
pristine structure upon which the original design analyses were carried out 
but upon a slightly damaged structure. The EIRT recommends the USAF re- 
examine the ultimate test requirements to determine if It is still sensible. 
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APPENDIX C DEFINITIONS & NOMENCLATURE 

Limit loads are the maximum loads that the aircraft is expected to actually 
experience during its life. The structure shall exhibit no detrimental 
permanent deformations after the application of limit loads. 

Ultimate loads are limit loads multiplied by the factor of safety which is spedfled 
to ba 1.5. The structure shall support without failure the ultimate loads. 

(Note: Ultimate loads are fictitious because the aeroelastic characteristics of 
the airplane makes it physcially impossible to develop these ultimate loads 
flight. This is in contradistinction to the limit loads lehich can be developed 
by the airplane.) 

* Design limit loads are the loads used for the design of the C-17. 

Test limit loads are the loads applied to the static test article that simulate the 
design limit loads. The simulation is ziot exact because of the limitations of 
the test fixtures. 



Test ultimate loads are test limit loads multiplied by the factor of safety of 1.5. 

Allowable • Requirement 
Margin of Safety B — ^ i 

Requirement 

where the allowable is the capability of the structure and the 
requirement is what is imposed on the structure by a design 
condition. For example, the allowable for a member in tension 
made of the aluminum alloy, 7150, is the tensile uldmate of 85 
ksi. If the stress induced by a particular ultimate loading 
condition is 80 ksi, then the Margin of Safety, M.S., is 

85-80 

M.S.S n .063 or 6.3% 

80 

For a structure subjected to multiaxial loadings, such as is the case 
for tiie upper surface of the C-17 wing, the determination of the 
margin of safety becomes much more involved than is shown 
by this example. 
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SP5005iM : The designation for the loading condition that terminated at 144% o: 
test limit load. SP refers to steady pitch (the airaaft is subjected to a pilot 
induced maneuver) and the M means modified to the 585,000 pound TOGK. 

DG5001: The designation for the loading condition that caused the wing failure 
on October 1, 1992, DG refers to discrete gust (the airplane encounters a gust) 
and the M means modified to thft 58SJO0Q pound TOGW. 



APPESTDIX D THE WTNTC STRUCTURE 

The wing in the region of the failure is comprised of two spars consisting 
of spar caps which are mechanically fastened to the spar webs. The upper and 
lower surfaces of the wing consists of z shaped stiffeners mechanically fastened 
the uing skins. Wing up>bending causes the upper surface to be in compressior. 
which means that structural instability is the dominant mode of failure. Each z 
stiffener plus a \\*idth of the skin is modeled as a structural entity called a beam- 
column that is subjected to compression, local bending and shear along the edges 
of the ^vidth of skin. The compression load is caused by up-bending (transverse 
bending) of the wing; the local bending is due to the combination of airload 
pressure, crushing pressure induoral by wing up-bending/ fuel pressure and 
coiuom compression combined by a beam-column analysis; and the shear is 
caused by the torsion which accompanies up-bending of the wing. The spar caps 
plus a width of skin are modeled as structural entities subjected to compression, 
local bending and shear along the edges of the width of skin. However, column 
buckling is not critical because the skin prevents column buckling in one 
direction and the shear web prevents buckling in the perpendicular direction. 
The length of each beam-column is the distance between wing ribs. 

Column buckling determines the allowable for compression, crippling 
determines the allowable for local bending and the material shear stress is the 
allowable for the shear. Implicit in the modeling of the upper surface of the wir.s 
as a collection of beam-columns is that crippling of each of the components of 
the z stiffeners or spar caps will not occur at the loads used in the analyses of the 
beam-columns, i.e., the crippling allowable of each component is above the beas: 
column allowable. 

The ability of each beam<olumn to carry a given load is measured by a 
factor called the margin of safety, M.S. A zero margin of safety implies that the 
structure is perfectly designed and does not have any excess weight There are 
three components in the calculation of the M.S. for the beam-column, one 
weighing the effect of column budding, one weighing the effect of the local 
bending and one weighing the effect of shear. These three components are 
combined in an empirical interaction formula that was slightly modified by 
Douglas after the first static test failure. 

The wing of the C-17 is very effidentiy designed. This Is evident when the 
weight of the wing is compared to other airplanes. In the region of the failure. 
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zero margins of safety are shown for the front spar and for the adjacent two 
stiffeners. 



APPENDIX E STRUCTURAL INTEGRITY 

The static test failure of 1 October 1992 and the recent failxure of 10 September 
1993 has raised concms about the structtiral integrity of the C-17. It is important 
to realize that the two tests that caused failure represent only a small part of the 
total structural integrity program. 

A brief review of the major elements in the structural integrity program Is 
herein presented as the background for the findings, conclusions and 
recommendations made in the main body of this report 

The aircraft structure miist possess three main attributes: 

1. Strength to sustain flight, landing and taxi loads. 

2. Rigidity to prevent detrimental aeroelastic effects such as 

flutter and aileron reversal. 

3. Longevity to sustain the cyclic application of flighty landing 

and taxi loads for a specified number of flight hours, landings 

and calendar years. ' 
At a particular region of the airframe, the physical sizes, e.g., thickness of the 
skin or the spacing of the stiffeners, may be dictated by any one of the thxee 
desired attributes. In the C-17, the lower surface of the wing is sized primarily by 
longevity and the upper surface primarily by strength to resist buckling. Rigidin* 
considerations are a factor in determining the spanv^rise location of the engines' 
on the wing. 

In metal airplanes the repeated application of flight, landing and taxi loads 
will lead to the initiation of cracks that, if unrepaired, will grow to a size such 
that the damage tolerance strength requirements will be compromised. The 
detection of cracks and their repair can be a major maintenance burden. Thus, of 
the three attributes, longevity is the one that has the greatest impact on operatine 
costs because continual surveillance is required for the detection of cracks. 

There are two facets to the strength attribute. The first is the capability to 
sustain design limit loads without permanent deformations, i.e., the structure 
must be reusable after experiencing design limit loads. The second is to sustain 
design ultimate loads without failure but the structure is not required to be 
reusable after experiencing design ultimate loads and indeed there is no 
requirement to be reusable after experiencing loads greater than design limits 
loads. Design limit loads are the maximum of those which the airplane is 
expected to experience during its life. In contrast, the design ultimate loads, 
which are legislated to be nuiherically equal to the factor of safety times the 
design limit loads, are fictitious in the sense that the airplane cannot be flown so 
as to develop design ultimate loads. The factor of safety is 1.5. It is impossible to 
satisfy the ultimate requirement without first satisfying the limit requirement so 
that from this viewpoint, the limit condition is the more important of the two. 
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The design ultimate requirement is intended to take care o( unk-unks, 
unknown-unknowns. One can argue that the range of unk-unks for the C-17, the 
fifth generation of military transport category aircraft, is much less than for the 
DC-3. N^onetheless, airplanes designed to the factor of safety of 1.3 have been 
successful in meeting their strength requirements. 

There are three full scale airframes devoted to the verification of the design 
analyses: 

One is a flight test airplane used to vexiiy the aerodynamic loads. This flight 
test airplane is also used to demonstrate duit flutter and other aeroeUstic 
phenomena are beyond the normal flight 

envelop of the airplane, i-e., to validate the rigidity attributes. 

A second airframe is used to verify tfie longevity attributes by the cyclic 
application of the loads to be e^q^erlenc^ in flight. This test is rekrred to 
as the durability test (also known as the fatigue test) by the USAF and its 
objective is to validate the crack initiation and crack growth 
characteristics of the airframe. The C-^l? durability airframe wiJFeycUc 
loaded to the equivalent of two lifetimes of usage; presently the 
diu-ability airframe is at the equivalent of one-half of a lifetime. There 
are some who would like to see the applicatiozvof a third lifetime on the 
durability airframe because recent cor\cen\s about aging airaaft, militar\* 
and civil, are best addressed by a third lifetime of durability testing. 

The third airframe is used to verify the strength attributes of the C-17. To 
date 24 separate tests' have been completed on. the static test article and 6 
more remain to be completed. 
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The Stresses used for the static strength design of the airframe are much larger 
than those used for the longevity, i.e., durability, design. This is shown in the 
accompanying traces of strain response from the durability test article, one from 
the upper surface and one from the lower surface. Both of these traces are taken 
from the worst case flight in the durability spectrum pf loading. 
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STRESSES IN UPPER SURFACE IN BAY 26 

In the upper surface the maximum compressive stress is seen to be 
approximately 20 ksi in the durability article whereas it reached a shade under 34 
ksi in the SP3005M test. 
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In the lower surface, the maximum tensile stress is seen to be approximatdy 12.5 
ksi in the durability article whereas this same location readied almost 27.5 ksi in 
the SP5005M test. 



APPENDIX F THE LOADING OF THE STATIC TEST ARTTCLE 

The structural design of the wing utilizes aerodynamic loads caused by a 
continuous distribution of pressures on the. surfaces of the wing. The 
aerodynamic loading together with the inertia loads caused by acceleration causes 
a traniisverse bending (up-bendlng) moment, a chordwlse bending moment a 
torsional moment, a transverse shear and a chordwise shear at each cross section 
of the wing. The chordwise bending moment and chrodwise st\ear are catised bv 
the drag on the wing and loads on the winglet. These moments and shears are ' 
used to determine the sizes of the stiffeners, spar caps and skins. It is important 
to remember that all five structural effects, (i) transverse bending, (ii) chordwise 
bending, (iii) torsion, (iv) transverse shear and (v) chordwise shear are included 
in the design analyses and that the calculation of these effects are based on a 
continuous distribution of loads. 
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Tlie test loads that simulate the design loads are applied to the static test 
article through tension pads bonded onto the upper surface of the wing. Attached 
to these tension pads are mechanical linkages that are attached by a whiffle-tree 
assemblage to a system of hydraulic jacks. This loading system does not simulate 
the effects of chordwise bending nor chordwise shear because it is not practical to 
place another whiffle tree system onto the wing due to the large deflections 
experienced by the wing under load. In particular^ the chordwise bendSng^cftused 
by the winglet loads are neglected. These chordwise effects which are induded ir. 
the design of the wing are generally an order o( magnitude smaller than thwas 
overlaoded re knowingly omitted from the static test. 

Thus, at a given location in the wing^ the margin of safety at 150% of design 
limit load will not be exactly the same as the margin of safety at 150% of test linxi: 
load because the test loads do not exactly duplicate the design loads. For CMample. 
the following table compares design and test margins of safe^ in bay ,26i(»the 
spar cap and thnae adjacent sti£femers: ' . ./ ■ 



Front Spar Cap 



T 

34 



12 11 
Stringers 





Front 
Spar Cap 


Stringer 
34 


Stringer 
12 


Stringer 
11 


Margins of Safety 

at 150% of 
Design Limit Load 


0.04 


0 


0 


0.10 


t\4argins of Safety 

at 150% of 
Test Limit Load 


0 


0 


0 


0.02 



These are the margins of safety, calculated prior to the conduct of the test, 
for condition SPS005M that caused the failure. The zero margin of safety shown 
for the front spar cap indicates that the front spar cap is load^ nwre severly by 
the test than it should have been. In other words, the test loads cause larger 
stresses in the spar cap than were used for the sizing of the spar cap. 
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